Amendments to the Claims 
Please cancel claims 1-12 and 14-23 and add new claims 24-44 as follows: 
1.-12. (Cancelled) 

13. (Original) A method of displaying an expression being capable of representation in infix and 
prefix notation, and comprising a plurality of operators and operands, the method comprising: 

displaying the expression as a prefix expression tree, wherein the plurality of operands 

comprise the leaves of the expression tree; and 
inserting a plurality of infix operators corresponding with the plurality of operators into 

the prefix expression tree, wherein, the plurality of operands and infix operators 

represent the expression in infix notation. 

14. -23. (Cancelled) 

24. (New) A user interface for representing an expression, comprising: 

a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 
a plurality of internal nodes that include a plurality of operators of the expression; 
and 

a plurality of leaf nodes that include a plurality of operands of the expression; and 
a plurality of symbols, adjacent to the plurality of operands in the tree, the plurality of 
symbols and the plurality of operands representing the expression in infix 
notation. 

25. (New) The user interface of claim 24, wherein the expression comprises a Boolean 
expression. 
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26. (New) The user interface of claim 25, wherein the Boolean expression comprises a rule in a 
computer network security system. 

27. (New) The user interface of claim 24, wherein a first portion of the user interface includes the 
plurality of operators, and wherein a second portion of the user interface includes the plurality of 
operands and the plurality of symbols, and wherein the first portion and the second portion do not 
overlap. 

28. (New) The user interface of claim 27, wherein the plurality of symbols includes an open 
parenthesis that indicates an order of operations. 

29. (New) The user interface of claim 28, wherein the open parenthesis is located in the second 
portion of the user interface adjacent to an operator. 

30. (New) The user interface of claim 27, wherein the plurality of symbols includes an infix 
operator. 

31. (New) The user interface of claim 30, wherein the infix operator is located in the second 
portion of the user interface adjacent to an operand. 

32. (New) The user interface of claim 24, wherein an operator of the plurality of operators is 
displayed symbolically. 

33. (New) The user interface of claim 24, wherein an operator of the plurality of operators is 
displayed textually. 

34. (New) The user interface of claim 24, wherein the plurality of operators includes a logical 
operator. 

35. (New) The user interface of claim 24, wherein an operand of the plurality of operands 
includes an expression that includes a comparative operator. 

36. (New) A computer-implemented method for displaying an expression, comprising: 
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displaying a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 
a plurality of internal nodes that include a plurality of operators of the expression; 
and 

a plurality of leaf nodes that include a plurality of operands of the expression; and 
displaying a plurality of symbols, adjacent to the plurality of operands in the tree, the 

plurality of symbols and the plurality of operands representing the expression in 
infix notation. 

37. (New) The method of claim 36, further comprising: 

receiving data indicating a change to the first portion of the user interface; and 
updating the second portion of the user interface based on the received data. 

38. (New) The method of claim 37, wherein the change to the first portion includes one of an 
insertion of an operator and a deletion of an operator. 

39. (New) The method of claim 37, wherein updating the second portion of the user interface 
includes changing a symbol. 

40. (New) The method of claim 36, further comprising: 

receiving data indicating a change to the second portion of the user interface; and 
updating the first portion of the user interface based on the received data. 

41. (New) The method of claim 40, wherein the change to the second portion includes one of an 
insertion of a parenthesis and a deletion of a parenthesis. 

42. (New) The method of claim 40, wherein updating the first portion of the user interface 
includes changing the graphical representation of the tree. 
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43. (New) The method of claim 36, further comprising displaying an expansion box, associated 
with an operator, configured to toggle between showing or hiding operands of the associated 
operator. 

44. (New) A network security system, comprising: 

a plurality of agents to collect security events from a plurality of network security 
devices; 

a manager including a rules engine to correlate the collected security events according to 
a set of rules; and 

a console interface to edit a rule from the set of rules using a user interface, the user 
interface comprising: 

a graphical representation of a tree that represents the expression, containing: 
a root node that includes a first operator of the expression; 
a plurality of internal nodes that include a plurality of operators of the 
expression; and 

a plurality of leaf nodes that include a plurality of operands of the 
expression; and 

a plurality of symbols, adjacent to the plurality of operands in the tree, the 
plurality of symbols and the plurality of operands representing the 
expression in infix notation. 
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